.gitleaks.toml

# Software Name: OUDS Flutter
# SPDX-FileCopyrightText: Copyright (c) Orange SA
# SPDX-License-Identifier: MIT
#
# Gitleaks configuration file for OUDS Flutter project.
# Reference: https://github.com/gitleaks/gitleaks#configuration

title = "OUDS Flutter Gitleaks Configuration"

[extend]
# Extend the default gitleaks configuration
useDefault = true

# ── Allowlist ────────────────────────────────────────────────
# Paths to exclude from scanning
[allowlist]
  description = "Global allowlist"
  paths = [
    '''pubspec\.lock''',
    '''\.dart_tool/''',
    '''build/''',
    '''\.gradle/''',
    '''Pods/''',
    '''DerivedData/''',
    '''\.png$''',
    '''\.svg$''',
    '''\.ttf$''',
    '''\.otf$''',
    '''\.webp$''',
    # Firebase config — contains API keys intended for client-side use (restricted by Firebase rules)
    '''google-services\.json''',
    '''GoogleService-Info\.plist''',
  ]

  # AWS S3 CDN URLs in documentation comments are not secrets
  regexes = [
    '''X-Amz-Credential=AKIA[A-Z0-9]{16}''',
    # This specific key appears in AWS CDN documentation URLs, not a real credential
    '''AKIA3AVNYHQKW6TV54VB''',
  ]